Threats tagged 'ghsa-p9g7-73wv-cwgh'

Semantic MediaWiki versions from 2.4.0 up to but not including 7.4.1 contain a reflected cross-site scripting (XSS) vulnerability in the TimeValueFormatter::getCaptionFromFreeFormat() function. This flaw allows unauthenticated attackers to craft a Special:Ask URL with malicious HTML markup in a date printout format, which is then emitted without proper escaping. When a logged-in user accesses such a URL, the injected script executes in their browser session, potentially compromising confidentiality and integrity.